A Taxonomy of Anomalies in Distributed Cloud Systems: The CRI-Model

Abstract

Anomaly Detection (AD) in distributed cloud systems is the process of identifying unexpected (i.e. anomalous) behaviour. Many approaches from machine learning to statistical methods exist to detect anomalous data instances. However, no generic solutions exist for identifying appropriate metrics for monitoring and choosing adequate detection approaches. In this paper, we present the CRI-Model (Change, Rupture, Impact), which is a taxonomy based on a study of anomaly types in the literatureand an analysis of system outages in major cloud and web-portal companies. The taxonomy can be used as an anlaysis-tool on identified anomalies to discover gaps in the AD state of a system or determine components most often affected by a particular anomaly type. While the dimensions of the taxonomy are fixed, the categories can be adapted to different domains. We show the applicability of the taxonomy to distributed cloud systems using a large dataset of anomaly reports from a software company. The adaptability is further shown for the production automation domain, as a first attempt to generalize the taxonomy to other distributed systems.

Appendices

Appendix A: Literature Sources Used for the Taxonomy

• Barford, P. et al.: A signal analysis of network traffic anomalies. In: the second ACM SIGCOMM Workshop, 71–82 (2002)

• Cheng, H. et al.: Detection and Characterization of Anomalies in Multivariate Time Series. In: Proc. SIAM, 413–424 (2009)

• Cohen, I. et al.: Correlating Instrumentation Data to System States: A Building Block for Automated Diagnosis and Control. In: Proc. of the 7th symp. on Operating systems design and implementation. 4. (2004)

• Düllmann, T.: Performance Anomaly Detection in Microservice Architectures Under Continuous Change. Masterthesis. University of Stuttgart, 2017

• Dunning, T. and Friedman, E.: Practical Machine Learning: A New Look At Anomaly Detection. (2014), p. 65

• Fu, Q. et al.: Execution anomaly detection in distributed systems through unstructured log analysis. In: Proce.—IEEE International Conference on Data Mining December, 149–158 (2009)

• Goldstein, M. and Uchida, S.: A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data. In: PloS one 11.4 (2016): e0152173 11.April, 1–31 (2016)

• Gu, X. and Wang, H.: Online anomaly prediction for robust cluster systems. In: Proc.—International Conference on Data Engineering, 1000–1011 (2009)

• Guan, Q. et al.: Efficient and accurate anomaly identification using reduced metric space in utility clouds. In: Proc.—IEEE 7th Int. Conf. on Networking, Architecture and Storage, 207–216 (2012)

• Gupta, M. et al.: Context-Aware Time Series Anomaly Detection for Complex Systems. In: Proc. of the SDM Workshop on Data Mining for Service and Maintenance, 14–22 (2013)

• Hole, K.: Anomaly detection with htm. In: Anti-fragile ICT Systems. Springer International Publishing, 2016. Chap. Anomaly de, pp. 125–132

• Ibidunmoye, O., Hernández-Rodriguez, F., and Elmroth, E.: Performance Anomaly Detection and Bottleneck Identification. In: ACM Computing Surveys 48.1, 1–35 (2015)

• Munawar, M. et al.: Filtering system metrics for minimal correlation-based selfmonitoring. In: IEEE Int. Conf. on Self-Adaptive and Self-Organizing Systems, 233–242 (2009)

• Sharma, A. et al.: Fault detection and localization in distributed systems using invariant relationships. In: IEEE/IFIP Int. Conf. on Dependable Systems and Networks 1, 1–8 (2013)

• Sheth, A. et al.: Mojo: A Distributed Physical Layer Anomaly Detection System for 802.11 WLANs. In: Proc. of the 4th int. conf. on Mobile systems, applications and services, 191 (2006)

• Smith, D., Guan, Q., and Fu, S.: An anomaly detection framework for autonomic management of compute cloud systems. In: Proc.—Int. Computer Software and Applications Conf. 376–381 (2010)

• Takeishi, N. and Yairi, T.: Anomaly detection from multivariate time-series with sparse representation. In: Proc.—IEEE Int. Conf. on Systems, Man and Cybernetics 2014-Janua.January, 2651–2656 (2014)

• Tan, Y. et al.: PREPARE : Predictive Performance Anomaly Prevention for Virtualized Cloud Systems. In: Distributed Computing Systems (ICDCS). Vcl, pp. 285–294 (2012)

• Thottan, M. and Ji, C.: Proactive anomaly detection using distributed intelligent agents. In: Network, IEEE October, 21–27 (1998)

• Wang, T. et al.: Fault Detection for Cloud Computing Systems with Correlation Analysis. In: 652–658 (2015)

Appendix B: Reports of System Outages

Table 3 The List of system outages reports from (software) companies